Investigating Transparent Web Proxies in Cellular Networks

Transcription

1 Investigating Transparent Web Proxies in Cellular Networks Xing Xu, Yurong Jiang, Tobias Flach, Ethan Katz-Bassett, David Choffnes, Ramesh Govindan USC & Northeastern University March 20, 2015

2 Introduction Mobile devices are primary web devices now, generating large amounts of Web traffic Traffic often passes through proxies deployed by cellular providers We don t know much about the proxy s features and their impact on performance 2

3 Overview Goal: Understand the behavior and impact of proxies on mobile users Results: All four major US cellular carriers use HTTP proxies Varying proxy features like object caching, image compression, or redirecting traffic based on a proxy s DNS resolution Proxies enhance performance in some (not all) scenarios 3

4 Background Client Server Mobile Carrier Network Public Internet 4

5 Background Client Client-facing connection Proxy Mobile Carrier Network Server-facing connection Server Public Internet Want to detect proxies and their features 5

6 Outline Overview Proxy detection and prevalence Proxy features Performance impact of split connections Conclusion 6

7 Proxy Interference! Compare client and server packet captures to detect proxy interference 7

8 Testbed Seattle Chicago? Boston?? Los Angeles? 8

9 Testbed Seattle Chicago! Boston!! Los Angeles! All carriers deploy proxies interfering with cellular traffic regardless of the client s location 9

10 Follow-up Questions 1 Is access to real websites and different content types also proxied? 2 How can we extend the methodology to a setting where we do not control the server? 10

11 Fingerprinting A No control SYN-ACK VS. B SYN-ACK 11

12 Fingerprinting No control SYN-ACK If client receives SYN-ACK without server receiving SYN, then the proxy split the connection Proxy fingerprint 12

13 Fingerprinting No control SYN-ACK Fingerprint on receiver window, window scaling factor, maximum segment size (MSS), and IP/ID pattern extracted from IP and TCP headers 13

14 Fingerprinting A No control SYN-ACK VS. B SYN-ACK 14

15 Proxy detection for Web traffic Collect traces using different access methods (cellular [c] vs. wired [w]) and protocols (HTTP [h] vs. HTTPS [s])? Mobile Access Wired Access 15

16 Proxy detection for Web traffic We know that: Traffic is proxied when accessing our own web server, i.e. the proxy generated Want to show that: Cellular HTTP traffic is proxied when accessing a non-controlled web server, i.e. proxy generated For this the following conditions need to hold: Server and proxy signatures do not match Signatures do not differ because of access type 16

17 Results for Web Traffic Proxying Alexa top 100 index pages All are proxied Additionally tested streaming URLs for Hulu, Netflix, and YouTube Proxied, except: T-Mobile bypasses proxy for Youtube video traffic 17

18 Outline Overview Proxy detection and prevalence Proxy features Performance impact of split connections Conclusion 18

19 Proxy Features Delayed Handshaking Redirection Transfer Caching Rewriting Content Teardown Connection Persistence Setup 19

20 Delayed Handshaking Server connection only established after proxy sees HTTP GET SYN HTTP GET SYN HTTP GET Observed with all four carriers Extra delay Extra delay depends on server-side latency 20

21 Redirection Google Public DNS? A A 21

22 Redirection Google Public DNS Destination IP: A Host: A B Ignores destination IP, does independent DNS resolution Observed with T-Mobile Complicates client-side diagnostics 22

23 Caching 1 Proxy serves cached copy 2 23

24 Caching Observed with T-Mobile and Sprint Most web objects are cached (excluding HTML) 24

25 Caching Caching is only beneficial for smaller files on connections with high server latencies 25

26 Rewriting Content A B Only observed for Sprint, which recompresses images 26

27 Rewriting Content Images up to 500 KB original size compressed Aggressive compression reduces fetch time and data usage 27

28 Proxy Features Delayed Handshaking Redirection Transfer Caching Rewriting Content Teardown Connection Persistence Setup 28

29 Outline Overview Proxy detection and prevalence Proxy features Performance impact of split connections Conclusion 29

30 Fetching a Single Object Cellular segment is the bottleneck with Sprint, resulting only in minimal latency reductions when connections are split 30

31 Measuring Impact on Web Browsing We replicate and host websites locally at our own server on both port 80 (proxied) and port 7777 (to bypass proxy) Tested three scenarios: A. News site (18 objects) B. Search (12 objects) C. Image site (8 objects with 2 large images) 31

32 Web Browsing: Results Proxy buffering compensates for loss episodes on server-facing connection Image compression massively reduces fetch times 32

33 Conclusion Cellular carriers use proxies with features like caching or image compression Through a fingerprinting technique, we found that traffic is proxied for almost all websites accessed via HTTP Split connections improve performance, especially when proxies buffer data or compress images, and when the serverfacing connection is the bottleneck 33